Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Usually a limited amount of services are configured on a server and most of the not needed ones are shut down, I was wondering what would be the best approach to firewalling with iptables.

Is it better to filter by denying a specific service from a specific interface or network and leaving unused ports open or is it better so set the chain policy to drop and then start opening up what is needed?

share|improve this question
up vote 10 down vote accepted

There are many schools of thought when it comes to system level firewalling.

One conservative approach that is often seen is to use connection tracking to match and explicitly accept incoming RELATED or ESTABLISHED traffic. All other incoming traffic is dropped by default. Explicit rules are added as necessary for various services to accept unmatched incoming traffic.

Outgoing traffic is not filtered in most scenarios.


-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -m conntrack --ctstate INVALID -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT

The above iptables-save snippet shows a setup that drops inbound and forwarding packets by default and accepts outgoing packets by default. Inbound traffic from localhost is explicitly accepted, as are RELATED and ESTABLISHED packets (e.g. responses to an http request), and all traffic to port 22 (SSH).

share|improve this answer
Some would say this isn't conservative enough and you should drop outgoing packets except to destinations you know you should be connecting to: DNS server, mail server (if it should send mail at all), the webservices you consume, the upgrade repository, etc. – DerfK Feb 19 '14 at 6:29
You haven't set connection tracking on the ssh rule? – Michael Hampton Feb 19 '14 at 11:51
@MichaelHampton The rule matching RELATED and ESTABLISHED packets will accept traffic for existing SSH connections. The rule matching port 22 is only necessary to accept the initial incoming connection to that service. – Mark Sturgill Feb 19 '14 at 17:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.